Video & PDF Document Steganography

PDF Steganography & Object Analysis

PDF documents are structured container formats composed of indirect objects (obj ... endobj), stream dictionaries, and incremental update sections.

Data can be hidden:

• Inside unreferenced PDF objects (invisible to PDF readers).
• In compressed streams (/FlateDecode).
• Appended beyond the %EOF (End Of File) marker.

---

1. Inspecting PDF Files with Didier Stevens Tools

pdfid

Scans a PDF document for suspicious elements (/JavaScript, /JS, /AA, /OpenAction, /EmbeddedFiles):

pdfid document.pdf

pdf-parser

Extracts and decompresses specific PDF objects:

# List all indirect objects in PDF
pdfparser.py document.pdf

# Search for stream objects
pdfparser.py -s /Stream document.pdf

# Decompress and dump content of object 7
pdfparser.py -o 7 -d raw_obj7.bin document.pdf

---

2. Video Steganography Analysis

Video files (.mp4, .avi, .mkv) consist of container formats, audio tracks, and sequential video frame images.

Frame-by-Frame Extraction with FFmpeg

Steganographers often hide flags inside a single specific video frame or as flickering LSB noise:

# Extract all video frames as PNG images into frames/ directory
mkdir frames
ffmpeg -i video.mp4 -vsync 0 frames/frame_%04d.png

Once extracted:

1. Run zsteg or stegsolve on individual frame images.
2. Check for visual anomalies across sequential frames (e.g., QR code components flashed for 1 frame).

Audio Track Separation

Extract hidden audio tracks or metadata streams:

# Extract raw audio stream without re-encoding
ffmpeg -i video.mp4 -vn -acodec copy extracted_audio.wav

Inspect extracted_audio.wav in Audacity under Spectrogram View.